/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */

/*

 * COPYRIGHT (C) 2006

 * THE REGENTS OF THE UNIVERSITY OF MICHIGAN

 * ALL RIGHTS RESERVED

 *

 * Permission is granted to use, copy, create derivative works

 * and redistribute this software and such derivative works

 * for any purpose, so long as the name of The University of

 * Michigan is not used in any advertising or publicity

 * pertaining to the use of distribution of this software

 * without specific, written prior authorization.  If the

 * above copyright notice or any other identification of the

 * University of Michigan is included in any copy of any

 * portion of this software, then the disclaimer below must

 * also be included.

 *

 * THIS SOFTWARE IS PROVIDED AS IS, WITHOUT REPRESENTATION

 * FROM THE UNIVERSITY OF MICHIGAN AS TO ITS FITNESS FOR ANY

 * PURPOSE, AND WITHOUT WARRANTY BY THE UNIVERSITY OF

 * MICHIGAN OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING

 * WITHOUT LIMITATION THE IMPLIED WARRANTIES OF

 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE

 * REGENTS OF THE UNIVERSITY OF MICHIGAN SHALL NOT BE LIABLE

 * FOR ANY DAMAGES, INCLUDING SPECIAL, INDIRECT, INCIDENTAL, OR

 * CONSEQUENTIAL DAMAGES, WITH RESPECT TO ANY CLAIM ARISING

 * OUT OF OR IN CONNECTION WITH THE USE OF THE SOFTWARE, EVEN

 * IF IT HAS BEEN OR IS HEREAFTER ADVISED OF THE POSSIBILITY OF

 * SUCH DAMAGES.

 */

#ifndef _KRB5_INT_PKINIT_H

#define _KRB5_INT_PKINIT_H

/*

 * pkinit structures

 */

/* PKAuthenticator */

typedef struct _krb5_pk_authenticator {

    krb5_int32      cusec;  /* (0..999999) */

    krb5_timestamp  ctime;

    krb5_int32      nonce;  /* (0..4294967295) */

    krb5_checksum   paChecksum;

    krb5_data      *freshnessToken;

} krb5_pk_authenticator;

/* AlgorithmIdentifier */

typedef struct _krb5_algorithm_identifier {

    krb5_data algorithm;      /* OID */

    krb5_data parameters; /* Optional */

} krb5_algorithm_identifier;

/* SubjectPublicKeyInfo */

typedef struct _krb5_subject_pk_info {

    krb5_algorithm_identifier   algorithm;

    krb5_data                   subjectPublicKey; /* BIT STRING */

} krb5_subject_pk_info;

/** AuthPack from RFC 4556*/

typedef struct _krb5_auth_pack {

    krb5_pk_authenticator       pkAuthenticator;

    krb5_subject_pk_info        *clientPublicValue; /* Optional */

    krb5_algorithm_identifier   **supportedCMSTypes; /* Optional */

    krb5_data                   clientDHNonce; /* Optional */

    krb5_data                   **supportedKDFs; /* OIDs of KDFs; OPTIONAL */

} krb5_auth_pack;

/* ExternalPrincipalIdentifier */

typedef struct _krb5_external_principal_identifier {

    krb5_data subjectName; /* Optional */

    krb5_data issuerAndSerialNumber; /* Optional */

    krb5_data subjectKeyIdentifier; /* Optional */

} krb5_external_principal_identifier;

/* PA-PK-AS-REQ (rfc4556 -- PA TYPE 16) */

typedef struct _krb5_pa_pk_as_req {

    krb5_data signedAuthPack;

    krb5_external_principal_identifier **trustedCertifiers; /* Optional array */

    krb5_data kdcPkId; /* Optional */

} krb5_pa_pk_as_req;

/** Pkinit DHRepInfo */

typedef struct _krb5_dh_rep_info {

    krb5_data dhSignedData;

    krb5_data serverDHNonce; /* Optional */

    krb5_data *kdfID; /* OID of selected KDF OPTIONAL */

} krb5_dh_rep_info;

/* KDCDHKeyInfo */

typedef struct _krb5_kdc_dh_key_info {

    krb5_data       subjectPublicKey; /* BIT STRING */

    krb5_int32      nonce;  /* (0..4294967295) */

    krb5_timestamp  dhKeyExpiration; /* Optional */

} krb5_kdc_dh_key_info;

/* ReplyKeyPack */

typedef struct _krb5_reply_key_pack {

    krb5_keyblock   replyKey;

    krb5_checksum   asChecksum;

} krb5_reply_key_pack;

/* PA-PK-AS-REP (rfc4556 -- PA TYPE 17) */

typedef struct _krb5_pa_pk_as_rep {

    enum krb5_pa_pk_as_rep_selection {

        choice_pa_pk_as_rep_UNKNOWN = -1,

        choice_pa_pk_as_rep_dhInfo = 0,

        choice_pa_pk_as_rep_encKeyPack = 1

    } choice;

    union krb5_pa_pk_as_rep_choices {

        krb5_dh_rep_info    dh_Info;

        krb5_data           encKeyPack;

    } u;

} krb5_pa_pk_as_rep;

/* SP80056A OtherInfo, for pkinit algorithm agility */

typedef struct _krb5_sp80056a_other_info {

    krb5_algorithm_identifier algorithm_identifier;

    krb5_principal  party_u_info;

    krb5_principal  party_v_info;

    krb5_data supp_pub_info;

} krb5_sp80056a_other_info;

/* PkinitSuppPubInfo, for pkinit algorithm agility */

typedef struct _krb5_pkinit_supp_pub_info {

    krb5_enctype      enctype;

    krb5_data         as_req;

    krb5_data         pk_as_rep;

} krb5_pkinit_supp_pub_info;

/*

 * Begin "asn1.h"

 */

/*************************************************************************

 * Prototypes for pkinit asn.1 encode routines

 *************************************************************************/

krb5_error_code

encode_krb5_pa_pk_as_req(const krb5_pa_pk_as_req *rep, krb5_data **code);

krb5_error_code

encode_krb5_pa_pk_as_rep(const krb5_pa_pk_as_rep *rep, krb5_data **code);

krb5_error_code

encode_krb5_auth_pack(const krb5_auth_pack *rep, krb5_data **code);

krb5_error_code

encode_krb5_kdc_dh_key_info(const krb5_kdc_dh_key_info *rep, krb5_data **code);

krb5_error_code

encode_krb5_reply_key_pack(const krb5_reply_key_pack *, krb5_data **code);

krb5_error_code

encode_krb5_td_trusted_certifiers(krb5_external_principal_identifier *const *,

                                  krb5_data **code);

krb5_error_code

encode_krb5_td_dh_parameters(krb5_algorithm_identifier *const *,

                             krb5_data **code);

krb5_error_code

encode_krb5_sp80056a_other_info(const krb5_sp80056a_other_info *,

                                krb5_data **);

krb5_error_code

encode_krb5_pkinit_supp_pub_info(const krb5_pkinit_supp_pub_info *,

                                 krb5_data **);

/*************************************************************************

 * Prototypes for pkinit asn.1 decode routines

 *************************************************************************/

krb5_error_code

decode_krb5_pa_pk_as_req(const krb5_data *, krb5_pa_pk_as_req **);

krb5_error_code

decode_krb5_pa_pk_as_rep(const krb5_data *, krb5_pa_pk_as_rep **);

krb5_error_code

decode_krb5_auth_pack(const krb5_data *, krb5_auth_pack **);

krb5_error_code

decode_krb5_kdc_dh_key_info(const krb5_data *, krb5_kdc_dh_key_info **);

krb5_error_code

decode_krb5_principal_name(const krb5_data *, krb5_principal_data **);

krb5_error_code

decode_krb5_reply_key_pack(const krb5_data *, krb5_reply_key_pack **);

krb5_error_code

decode_krb5_td_trusted_certifiers(const krb5_data *,

                                  krb5_external_principal_identifier ***);

krb5_error_code

decode_krb5_td_dh_parameters(const krb5_data *, krb5_algorithm_identifier ***);

krb5_error_code

encode_krb5_enc_data(const krb5_enc_data *, krb5_data **);

krb5_error_code

encode_krb5_encryption_key(const krb5_keyblock *rep, krb5_data **code);

krb5_error_code

krb5_encrypt_helper(krb5_context context, const krb5_keyblock *key,

                    krb5_keyusage keyusage, const krb5_data *plain,

                    krb5_enc_data *cipher);

#endif /* _KRB5_INT_PKINIT_H */